chore(.github): add concurrency control and restrict claude-review to repository PRs

[dclong]

Summary

• chore(workflows): add concurrency control and restrict claude-review to repository PRs

Changed files

Modified

• .github/workflows/claude-code-review.yml (+11/-5)

Commits

• 6d56bba chore(workflows): add concurrency control and restrict claude-review to repository PRs

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[dclong]

Claude finished @dclong's task in 1m 2s —— View job

---

Claude finished @dclong's task

• Gather context (diff, changed files)
• Understand the request (code review of PR chore(.github): add concurrency control and restrict claude-review to repository PRs #119)
• Review the workflow YAML changes
• Post review feedback

Review: .github/workflows/claude-code-review.yml

Change 1 — concurrency block (lines 13-15)

concurrency:
  group: claude-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

Groups runs per-PR and cancels a stale in-progress review when a new synchronize push comes in. This is correct and avoids wasted/overlapping review runs on rapid force-pushes.

Change 2 — job if: condition (lines 19-25)

if: |
  github.event.pull_request.head.repo.full_name == github.repository
  && github.event.pull_request.draft == false

This restricts the review job to PRs whose head branch lives in this repository (not a fork) and that are not drafts.

• Correctness: multi-line if: expressions joined with a leading && on the continuation line are a well-established GitHub Actions pattern (matches the previously commented-out example in this same file) and parse/evaluate correctly.
• Null-safety: if a fork PR's head repo has been deleted, github.event.pull_request.head.repo is null; GitHub Actions expressions return null (not an error) for property access on null, so null == github.repository safely evaluates to false rather than throwing.
• Security rationale (per the added comment): this workflow runs on pull_request (not pull_request_target), so secrets — including the ACTIONS_TOKEN PAT used to post the review comment — are available to the job even though it checks out the PR's head ref. Without this guard, a forked PR's attacker-controlled title/description could prompt-inject the AUTO_MERGE_APPROVED marker into a comment posted via a token belonging to an auto-merge allowlisted user. Restricting to same-repo, non-draft PRs closes that path. This is a legitimate and worthwhile hardening.
• The draft == false check is redundant with the ready_for_review trigger type (which only fires once a PR leaves draft) but is harmless defense-in-depth for opened/synchronize/reopened events that could still target a draft PR.

No correctness bugs or blocking issues found. This is a small, well-scoped, security-motivated change.

AUTO_MERGE_APPROVED